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IN-SITU EMULATION 
PACES NEW MICROS — 


Evolutionary development improves accuracy of simulation 
by moving the target processor closer to the application 


by David McCracken 


ment must grow rapidly to keep up with advances 
in very large scale integration technology. The in- 
creasing speed and complexity of semiconductor devices 
have especially taxed in-circuit emulation, which strives 
to accurately simulate the functional and electrical 
characteristics of a microprocessor. Present in-circuit 
systems position the target microprocessor as much as 
several feet away from the application circuit. Buffer 
devices separate it from the application electrically. The 
physical and electrical separation of microprocessor and 
application circuitry makes conventional in-circuit 
emulation a less adequate way than ever to simulate 
semiconductor devices. 
Following the current trend toward moving the target 
microprocessor closer to the application, in-situ emula- 
tion meets the requirements of very large scale integra- 
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tion (VLSI) simulation by 
placing the micropro- 
cessor directly in the ap- 
plication physically and, 
as much as possible, elec- 
trically. This often re- 
quires hybrid microcir- 
cuits to reduce the size of 
buffer and control cir- 
cuitry, producing an 
emulation plug that can comfortably fit into most appli- 
cations. However, the concept is initially demonstrated 
with a Z8™ in-situ emulator that has been built using 
standard integrated circuits (ICs), as only two ICs are 
needed for cable driving buffers in the emulation plug. 
The Z8 resides physically in the application with no buf- 
fering, producing complete electrical transparency. 


Challenges of in-circuit emulation 

In-circuit emulation (ICE) basically time-multiplexes a 
target device between development and application en- 
vironments. The target microprocessor communicates 
with a host computer while in the development environ- 
ment, performing program development functions 
specified by the operator, such as beginning execution at 
a particular address or sending breakpoint information 
for use in a display assembled by the host. While in the 
application environment, the target executes programs 
that are being developed, interacting only with the ap- 
plication hardware. 
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Fig 1 Effects of emulation. Oscilloscope trace at top shows 
Z8 output port driving highly capacitive load. Bottom trace 
shows typical ICE circuit driving same load through TTL 
buffer and short length of twisted pair. Its undershoot 
below 0 V can damage circuits 


Transparency of emulation, or the degree to which 
the target microprocessor in the development environ- 
ment resembles an unattached application, must be 
measured in both functional and electrical terms. Func- 
tional transparency has generally been achieved to a 
high degree through various implementations of 
memory bank switching so that development programs 
reside only in the target’s virtual address space and need 
not impinge on actual potential facilities.! Electrical 
transparency, however, has generally not been achieved 
because target microprocessors have been separated 
from the application both physically [up to several feet 
(+1 m)] and electrically by buffer devices.? The 
resulting signal delays and inaccurate drive/load simula- 
tions have not been an overwhelming problem in most 
situations because, until recently, most microprocessors 
operated at speeds low enough so that the signal delays 
became unimportant, and bus-oriented microprocessors 
usually are buffered in the application by devices similar 
to those used in the ICE circuitry. 

Now, VLSI technology challenges traditional ICE elec- 
trical non-transparency in two major respects. One is 
that the operating speeds of new microprocessors are 
entering regions where transistor-transistor logic (TTL) 
buffer delays become significant, especially when com- 
bined with signal delays through the connecting ribbon 
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cables. The other is the proliferation of increasingly 
complex single-chip microcomputers for which elec- 
trical, as well as functional, simulation is complicated. 
Metal oxide semiconductor I/O ports are particularly 
difficult to simulate using remote, cable-driving TTL 
devices. With more specialized functions, such as 
analog to digital conversion, moving into increasingly 
dense microcomputers, present emulation techniques 
may not be able to provide adequate simulation. 

Depending on the electrical characteristics of a par- 
ticular application, the accuracy of present ICE simula- 
tion varies. The oscilloscope display in Fig 1 
demonstrates several of the problems. The top trace is 
created by a Z8 output port driving a 0.01-uF capacitive 
load directly, as it would in an actual application. The 
bottom trace is produced by a typical ICE circuit with a 
TTL buffer driving a 1.5-ft (46-cm) twisted pair into the 
same application environment. Beyond obvious dif- 
ferences in waveforms, a particularly troublesome 
phenomenon is the voltage undershoot caused by im- 
pedance mismatches between buffer, cable, and applica- 
tion circuitry. In some cases, the signal excursion below 
zero volts could damage devices in the application, but 
this would not happen outside the development system. 
Impedance mismatch problems will increase as ICE 
speeds rise to accommodate faster VLSI microprocessor 
targets. Possibly the only reasonable solution is the use 
of line drivers and receivers at both ends of the cable so 
that whether or not the target microprocessor is located 
in situ, some active circuitry must still be located in the 
emulation plug. 


Evolution of in-circuit emulation 

The problems posed by VLSI are not new to ICE. Increas- 
ing microprocessor speeds, in particular, have prompted 
steady change in emulation methods. In first generation 
hardware [Fig 2(a)], the target processor was located in- 
side the development station, with a relatively short rib- 
bon cable leading to the application microprocessor 
socket. Originally, the target processor accessed pro- 
gram memory (as well as other development facilities) 
through the main system bus shared with a host pro- 
cessor. The host moved programs that were to be tested 
into system memory under operator direction. It then 
relinquished bus control to allow target access to the 
memory. Unfortunately, this memory was often not fast 
enough to test program execution in real time, especially 
when faster microprocessors became available. Also, in 
some designs, the host lost much of its system control 
while emulation proceeded, and the target micro- 
processor, having control of the main bus, could cause 
system crashes by improperly accessing program 
development and control facilities. These problems were 
mostly solved by using a 2-port memory, accessed 
separately by host and target, and dedicated to em- 
ulation. 

As microprocessors continued to increase in speed, 
and as development system users began to demand more 
flexible hardware, ICE designers moved the target pro- 
cessor into a buffer/adapter pod located in the cable 
between the development station and application system 
[Fig 2(b)]. This move required much more complex ICE 
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circuitry, with both memory and target control signals 
delivered to the buffer/adapter from the host through 
another ribbon cable. However, the relatively small pod 
could be placed close to the application, reducing the ef- 
fects of long cables on signal delay and impedance 
mismatches (even one extra foot of cable can severely 
aggravate problems caused by impedance mismatches). 
This second generation hardware has not dealt with 
electrical transparency in that buffers are still required 
between the target processor and application. In addi- 
tion, application circuitry still must drive both the cable 
to the pod and the standard device loads within the pod, 
instead of the actual microprocessor. 

To meet the challenges posed by VLSI in the form of 
greater speeds and unique functional and electrical 
characteristics of microcomputers, a third generation 
emulation can be extrapolated from the existing trend 


toward moving the target processor closer to the ap-. 


plication. As the target processor finally moves directly 
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Fig 2 Three generations of ICE. First generation systems 
have target processor inside development workstation (a). 
Second generation moves target processor down cable into 
pod near application (b). Third generation extends concepts 
by locating target processor directly inside application 
circuit (c) 


into the application [Fig 2(c)], the concept of in-situ 


emulation is established. A microcircuit, consisting of 
unpackaged ICs plus the target processor, can be at- 
tached to the end of the emulation cable. This circuit 
then becomes the in-situ emulation plug into the ap- 
plication. With cable drivers and receivers located in the 
plug itself, the buffer/adapter pod of the second genera- 
tion is eliminated. Many microprocessors need little or 
no circuitry in the plug beyond a processor and buffers. 
However, it may not be possible to produce a reason- 
ably convenient, complete in-situ emulation plug for 
some microprocessors, such as Intel’s 8086, in which in- 
struction prefetching increases emulation complexity. 
Nevertheless, emulation of these microprocessors can be 
improved by active line drivers and receivers in the plug, 
even if the target must still be in a remote pod. 


In-situ emulator 

Because electrical transparency is especially desirable in 
single-chip microcomputer emulation, it will be used as 
the area to demonstrate the in-situ concept. In addition, 
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a particular packaging configuration offered by Zilog, 
Mostek, and National Semiconductor lends itself to in- 
situ emulation. Zilog’s Z8*, Mostek’s 3870*, and Na- 
tional’s 8048/49/50 microcomputers are offered in 
several configurations, one of which includes a ‘‘piggy- 
back’’ read only memory (ROM) socket compatible with 
a standard memory device for program storage. For its 
8022 microcomputer, Intel calls the analogous product a 
‘*bond-out’’ version.® It lacks a piggyback socket. All 
versions are electrical, functional, and pin-compatible 
duplicates of mask-programmed versions. The piggy- 
back package was developed to provide an exact elec- 
trical simulation of a mask-programmed microcom- 
puter before committing a tentative program to an ir- 
reversible factory process. Piggyback microcomputers 
are intended as a final, electrically transparent test for a 
program developed in a non-transparent system. But 
with in-situ emulation, the development phase can also 
be transparent.* 

An emulation development system contains four 
primary elements: host, target, read/write program 
memory, and a means of communication between host 
and target. The piggyback socket provides a convenient 
communication and memory channel between the host 
and the target microcomputer. Only two integrated cir- 
cuit buffers are needed for the Z8 piggyback address 
outputs to drive twisted pairs back to the development 
station, where the dual-port program memory resides. 
Data line drivers are not required because data flow is 
unidirectional, as the Z8 can only read from the socket. 
The prototype, shown in Fig 3, is constructed using fully 
packaged ICs for the two buffers, creating a fairly high 
profile [0.8 in (2 cm)], which would be undesirable in 
some situations. A production hybrid version would 
reduce this to little more than that achieved by the ICE 
plugs now in use. Only one non-piggyback connection is 
required—to control the RESET pin of the Zs. 

The RESET pin connection brings up for ICE designers 
the critical question of how to anticipate a variety of ap- 
plication environments, assuming that total transpar- 
ency is virtually impossible. Obviously, the Z8 in-situ 
emulation is electrically transparent with respect to all 
pin functions other than RESET. But the RESET function, 
as well, can be made nearly transparent by anticipating 
the most practical application environments. This is not 
difficult, as the application RESET circuitry will take 
only two different forms. One is a standalone micropro- 
cessor configuration in which the Zs is allowed to reset 
itself on power-up, using an external capacitor for time 
delay (all single-chip microcomputers have this function 
on the chip to reduce low-end product cost). The other 
is an external driver to synchronize with other devices in 
a multiprocessing configuration. 

The emulator can anticipate the self-reset circuit 
simply by using a high impedance 3-state driver to con- 
trol the pin. Then, during emulation, when the emulator 
controller need not exercise its reset control, the driver is 
placed in its high impedance state, allowing the applica- 
tion reset to function normally. In the second configura- 
tion—which is much less common—the application cir- 
cuitry must be designed to accommodate the emulator 
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Fig 3 In-situ emulator for zs. Use of fully packaged chips 
for onboard address buffers gives prototype unusually high 
profile. Hybrid circuits need be only slightly higher than 
typical ICE plug. Single non-piggyback connection attaches 
to Z8 RESET pin 


because the two active reset pin drivers would directly 
oppose each other. In this case, the application reset 
driver must either have a series resistor connection to 
the pin or else be an open collector device, which must 
not be allowed to assert while the target microprocessor 
is executing in the development environment. 

It may seem, at first, that the Z8 in-situ emulator is no 
more than a simple ROM simulator, but this is not the 
case, as emulation facilities are provided through an 
adapter circuit, shown in Fig 4 (right side of the double 
board unit on the left). One function of the adapter is to 
create a quasi-write capability for the Z8 through its 
piggyback socket. This enables the target to execute 
breakpoint programs which send the target’s internal 
data to the host for display generation. Also, target 
restart and communication through bank-switching 
achieves functional transparency.! 

The Z8 in-situ emulator not only offers improved elec- 
trical simulation, but also has been achieved with much 
simpler circuitry than a similar ICE design, which 
requires complex buffering because of the multiple 
functions of Z8 pins. This microcomputer is highly 
reconfigurable; most of its pins can be individually 
changed from input to output under software control. 
One final achievement is that this circuitry is compatible 
with Mostek’s 3870 microcomputer, which provides the 
same pinout in its piggyback ROM socket. Thus, with no 
hardware changes other than connecting the cable to a 
different target processor, two different emulators can 
be produced. This in-situ emulator has one deficiency 
not found in second generation ICE. The Z8 can be 
reconfigured for external memory access through pins 
which would otherwise be I/O ports. With full control 
over all target pins, the ICE can provide substitutes for 
nonexistent application memory, which the in-situ 
emulator cannot. A complete development system could 
offer both forms of emulation.°® 


*Zilog has introduced a universal peripheral controller 
microcomputer with a piggyback package, the Z8090-UPC; 
Phillip’s German subsidiary, Valvo GmbH, has introduced a 
piggyback series similar to the 8048 called the MAB8400. 


Fig 4 Prototype hardware for in-situ emulation. 
Complete system has emulation plug to replace application 
microprocessor (at right). Adapter circuit allows target 
processor to access dual port memory and channel for 
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As accurate VLSI simulation demands increasing ICE 
performance, the evolutionary development of ICE 
design suggests placing the target processor directly in 
the application, creating in-situ emulation. This can 
provide the improved speed and signal quality required 
by faster processors and more accurate electrical simula- 
tion for single-chip microcomputers. Even where the 
complexity of microprocessors precludes the ideal in- 
situ form, active circuitry in the emulation plug will pro- 
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